crates/monetize-guardian/src/lib.rs
//! **The estate guardian's shared runner** (5.4 resilience).
//!
//! Monetize never calls INTO an estate. Each box calls monetize ([`fleet`]): it reports
//! (its arrival time IS liveness), it pulls the orders queued for it, and it asks. The
//! guardian ([`runner::Guardian`]) reads those reports through the product's
//! [`monetize_product::guardian::EstateGuardian`], opens a [`case::Case`] per estate, takes a
//! human's button (strong auth, principal recorded) or the estate's auto-fix opt-in (off by
//! default), does the CLOUD part itself through `monetize_cloud::Cloud` — the fence
//! invariant: no lay for a role until its old box is gone — and "fires" only by queuing a
//! SIGNED order the box fetches, verifies under `monetize_pubkey` and runs through the
//! product's own repair verb (gunnar: `gunnar-repair`).
pub mod case;
pub mod fleet;
pub mod pulled;
pub mod runner;
pub mod start;
pub mod store;
pub use case::{Case, CaseState, CaseStep, Line};
pub use fleet::FleetRefusal;
pub use runner::{Guardian, GuardianConfig, LaidBox, PressRefusal, ProviderLook, World, AUTO_PRINCIPAL, NOT_LOOKED_YET, PROVIDER_LOOK_EVERY_MS};
pub use start::{backoff_ms, START_BACKOFF_MS, START_HANDOVER_AFTER, START_PRINCIPAL, STOPPED_AT_PROVIDER};
pub use store::{BoxRecord, Hold, Store, StoreError, StoreErrorKind, UNTIL_PINNED};